A transit authority must keep rider phone numbers and addresses out of foundation-model interaction logs. Which privacy control should the team apply in the messaging pipeline?

Detecting PII in rider messages and masking it before those messages are written to foundation-model interaction logs is the privacy control that keeps phone numbers and addresses out of durable FM telemetry while preserving operational usefulness. Transit messaging pipelines should run detection (regex, ML classifiers, or managed PII filters) on inbound rider text, replace phones/addresses with tokens or redaction markers, then persist the scrubbed content to FM request/response logs. Ops still sees conversation structure for incidents and quality review without retaining identifiers the transit authority pledged to keep out of FM logs.

Logging full rider messages verbatim so support can replay every token retains the exact PII the requirement forbids and expands breach and records-disclosure exposure. Disabling logging entirely removes the evidence needed for incident response, abuse investigation, and model-quality debugging—privacy by deletion of all telemetry is not an operational design. Encrypting logs with a single shared city password posted in the wiki is weak key management and does not remove PII from the plaintext that operators, backups, and future decryptors will still hold.

Exam caveat: separate encryption at rest from data minimization. Encryption protects confidentiality of stored blobs; masking before write reduces what sensitive fields exist in logs at all. FM logging questions often expect scrub-then-store, not encrypt-and-hope.

Operational check: inject synthetic rider messages containing phones and street addresses, confirm masked forms appear in FM logs, confirm raw PII does not, validate incident tooling still works on scrubbed traces, and document which fields are in scope for transit PII policy.